tag
Linux-Kernel
Zapscape — KVM/x86 Shadow-MMU Recursive-Zap Guest-to-Host Escape (CVE-2026-64561)
Zapscape (CVE-2026-64561) is a use-after-free in the KVM/x86 shadow MMU that lets a guest which uses nested virtualization escape to the host and run commands as the host kernel (root). Using guest-side actions alone, an attacker makes KVM recursively zap a…
ITScape — KVM/arm64 vGIC-ITS Guest-to-Host VM Escape (CVE-2026-46316)
ITScape (CVE-2026-46316) is a use-after-free in the KVM/arm64 in-kernel vGIC-ITS (Interrupt Translation Service) emulation that lets an unprivileged-but-rooted guest VM escape to the host and execute code as the host kernel (i.e., as root on the host), on any…
Linux Kernel rtmutex Priority-Inheritance Stack-UAF — "GhostLock" (CVE-2026-43499, Nebula Security weaponized variant)
Nebula Security independently discovered and weaponized a use-after-free in the Linux kernel's rtmutex priority-inheritance cleanup logic, naming it "GhostLock." They describe it as a stack-UAF reachable via ordinary threading/futex calls from any…
PinTheft: RDS zcopy Refcount-Steal Double-Free LPE — Pure NASM Rewrite (CVE-2026-43494)
This is a hand-written, dependency-free x86-64 NASM rewrite of the "PinTheft" Linux local privilege escalation exploit (originally published as PinTheft-go). It targets a refcount double-drop in the RDS zerocopy send path (rdsmessagezcopyfromuser()), which is…
Linux Kernel PPP Unprivileged User-Namespace Precondition Probe — CVE-2026-53075
This is a small local diagnostic probe, not a full weaponized exploit. It checks whether the preconditions for CVE-2026-53075 (an unprivileged-user attack path against the kernel ppp driver) are present on the running kernel: it creates an unprivileged…
Linux Kernel mm/mseal VMA-Merge Stale-Bound Bug (CVE-2026-23416)
CVE-2026-23416 is a logic bug in the kernel's mseal(2) implementation. msealapply() iterates over the target VMAs and advances its cursor by copying a previously-captured vmend value, but the underlying vmamodifyflags() call can merge adjacent VMAs…
Linux Kernel KFENCE Cross-Cache Free of SKB Head via bpf_prog_test_run_skb — CVE-2026-31429
Linux's skbkfreehead() decides which slab cache to free an SKB's head buffer back to based solely on whether endoffset equals SKBSMALLHEADHEADROOM, relying on the fact that SKBSMALLHEADCACHESIZE is a non-power-of-2 value that normally never collides with a…
Linux Kernel ICMP Fragmentation-Needed NULL Pointer Dereference (CVE-2026-23398)
CVE-2026-23398 is a NULL pointer dereference in the Linux kernel's ICMP handling path, reachable when a host has net.ipv4.ipnopmtudisc set to 3 (a hardened Path MTU Discovery mode) and receives a crafted ICMP "Fragmentation Needed" (type 3, code 4) packet.…
Linux Kernel Futex-PI rtmutex remove_waiter() Use-After-Free (CVE-2026-43499)
CVE-2026-43499 is a use-after-free in the Linux kernel's removewaiter() function (kernel/locking/rtmutex.c), which is shared between the ordinary rtmutex slow-unlock path and the futex priority-inheritance (PI) proxy-lock rollback path invoked from…
Linux FUSE Readdir Cache Out-of-Bounds Write to Root LPE — CVE-2026-31694
fuseadddirenttocache() is missing a bounds check when copying a FUSE server-supplied directory entry into the kernel's readdir page-cache. A malicious (or attacker-controlled) FUSE server can return a dirent with namelen = 4095, which serializes to a…
Linux BPF Verifier Scalar-Forking Soundness Bug to Container Escape — CVE-2026-31413
The Linux BPF verifier's maybeforkscalars() forks verifier state when it sees an ARSH followed by AND/OR with a constant. The forked ("pushed") path is generated via pushstack(env, env->insnidx + 1, ...), which skips the ALU instruction on that path and…
KVM SEV-SNP Page State Change (PSC) Heap Out-of-Bounds — CVE-2026-53360
KVM's SEV-SNP Page State Change (PSC) handler trusts a guest-supplied entry count against a fixed protocol constant (VMGEXITPSCMAXCOUNT = 253) instead of validating it against the actual size of the buffer the host allocated for the request. When a guest…
DirtyDecrypt-Go — RxRPC rxgk Page-Cache Overwrite LPE (Go Port) — CVE-2026-31635
This is a Go re-implementation ("port") of the original C dirtydecrypt PoC, now tracked as its own CVE (CVE-2026-31635). The bug is a missing skbcowdata() call in rxgkdecryptskb(): the krb5enc AEAD used by RxRPC's rxgk security class decrypts skb payload data…
Linux Kernel act_pedit Partial COW Page-Cache LPE (CVE-2026-46331)
CVE-2026-46331 is a local privilege escalation in the Linux kernel's net/sched/actpedit subsystem. The vulnerable function tcfpeditact() computes the writable Copy-on-Write (COW) region using a pre-calculated maximum hint (tcfpoffmaxhint) before the actual…
DirtyClone — Linux Kernel LPE via Cloned Packet Page-Cache Overwrite (CVE-2026-43503)
DirtyClone (CVE-2026-43503, CVSS 8.8) is the fourth member of the DirtyFrag family of Linux kernel local privilege escalation vulnerabilities. Each member shares the same root failure: file-backed page-cache memory is exposed to network packet operations, and…
ssh-keysign-pwn: pidfd_getfd FD Theft via mm-NULL Exit Window (CVE-2026-46333)
ssh-keysign-pwn demonstrates a local file-descriptor theft primitive on vulnerable Linux kernels. During process exit, a race window appears after exitmm() but before file descriptors are closed; in that state pidfdgetfd(2) can bypass expected dumpable checks…
PinTheft: RDS Double-Free → LPE
PinTheft is a Linux local privilege escalation exploit targeting a double-free in the RDS zerocopy send path (rdsmessagezcopyfromuser()). When a multi-page zerocopy send faults on a later page, the error path drops already-pinned pages, but RDS message…
DirtyDecrypt / DirtyCBC — rxgk Page-Cache Write (Dirty Pipe Variant)
DirtyDecrypt (also called DirtyCBC) is a variant of the CopyFail / DirtyFrag / Fragnesia bug class. rxgkdecryptskb() in net/rxrpc/rxgkcommon.h calls skbtosgvec() followed by cryptokrb5decrypt() without first calling skbcowdata(). The krb5enc AEAD template…
Linux vsock Use-After-Free VM Escape (CVE-2025-21756)
CVE-2025-21756 is a use-after-free vulnerability in the Linux kernel's vsock (virtual socket) subsystem. An attacker with code execution inside a virtual machine can exploit this bug to escape the VM boundary and gain root-level code execution on the…
Linux nf_tables Use-After-Free Local Privilege Escalation (CVE-2024-1086)
CVE-2024-1086 is a use-after-free vulnerability in the Linux kernel's netfilter nftables subsystem that allows an unprivileged local user to escalate privileges to root. The exploit achieves a 99.4% success rate on KernelCTF images and works universally…
Copy Fail Linux Kernel Local Privilege Escalation (CVE-2026-31431)
Copy Fail (CVE-2026-31431) is a Linux kernel local privilege-escalation vulnerability published by Theori (Xint Code). The provided PoC abuses AFALG AEAD socket operations with crafted parameters and splice() writes to patch privileged executable bytes and…
Dirty Frag: Linux XFRM/RxRPC Page Cache Write Chain LPE
Dirty Frag is a universal Linux Local Privilege Escalation (LPE) vulnerability class discovered by Hyunwoo Kim (@v4bel) that chains two Page Cache Write primitives: the xfrm-ESP Page-Cache Write (CVE-2026-43284) and the RxRPC Page-Cache Write…